ci: re-pin NWarila/.github reusables to a reachable commit

[NWarila]

Problem

New Template CI runs cannot start because the three reusable workflows and the repo-hygiene source_ref are pinned to NWarila/.github@5da716c68c90a86465d774f553d2f7161b60d616, which is unreachable after the control-plane repository's history rewrite. The ruleset-required ci-passed check therefore cannot be produced.

Fail-before run ID: 37980017730 (0 jobs; annotation: Invalid workflow file while parsing the called workflow at the reusable CodeQL reference because the workflow was not found).

Change

• Base SHA: 1a53b58ea3209c6d9f87c527814ddae1647d20fe
• Head SHA: 10d07dbec25888bfbdee8e8c6ec15ebca0bdef2a
• Re-pin SHA: 541fcec2ba7d64f16427754a2e1db23af5d1f1f8, read from NWarila/.github main
• Scope: four SHA substitutions in .github/workflows/template-ci.yml; no other file changed

Control-plane note: NWarila/.github has no stable release tag for these reusable workflows. Pinning the then-current main commit by full SHA makes this reference immutable, but another control-plane history rewrite can make the commit unreachable and require another explicit re-pin.

Acceptance

Live SHA read:

$ gh api repos/NWarila/.github/branches/main --jq .commit.sha
541fcec2ba7d64f16427754a2e1db23af5d1f1f8
[exit 0]

Section C pre-push block:

$ set -euo pipefail
[exit 0]
$ git fetch origin --tags --force
[exit 0]
$ BASE=$(git merge-base HEAD origin/main)
[exit 0]
$ test "$(git diff --name-only "$BASE" -- | tr '\n' ' ')" = ".github/workflows/template-ci.yml "
[exit 0]
$ git diff --check "$BASE" --
[exit 0]
$ test "$(grep -c '5da716c68c90a86465d774f553d2f7161b60d616' .github/workflows/template-ci.yml)" -eq 0
[exit 0]
$ NEW=$(gh api repos/NWarila/.github/branches/main --jq .commit.sha); test "$(grep -c "$NEW" .github/workflows/template-ci.yml)" -eq 4
[exit 0]
$ for f in reusable-repo-hygiene.yaml reusable-codeql.yaml reusable-scorecard.yaml; do gh api "repos/NWarila/.github/contents/.github/workflows/$f?ref=$NEW" --jq .name; done
reusable-repo-hygiene.yaml
reusable-codeql.yaml
reusable-scorecard.yaml
[exit 0]
$ command -v actionlint >/dev/null || { echo 'unobtainable-without-build: actionlint missing' >&2; exit 2; }
[exit 0]
$ actionlint .github/workflows/template-ci.yml
[exit 0]
$ python3 tools/check_release_drift.py   # governance preflight only (tags fetched above); not evidence for the re-pin
release-drift check passed
[exit 0]

CI run record

• Run ID: 37984641214
• Run URL: https://github.com/NWarila/python-template/actions/runs/37984641214
• Event: pull_request
• Head SHA: 10d07dbec25888bfbdee8e8c6ec15ebca0bdef2a
• Run conclusion: failure (expected pre-existing released-copy security failure)

Section C post-push block (RUN_ID=37984641214):

$ : "${RUN_ID:?set the template-ci run id for the pushed head}"
[exit 0]
$ test "$(gh run view "$RUN_ID" --json headSha --jq .headSha)" = "$(git rev-parse HEAD)"
[exit 0]
$ test "$(gh run view "$RUN_ID" --json jobs --jq '.jobs|length')" -gt 0
[exit 0]
$ gh run view "$RUN_ID" --json jobs --jq '.jobs[] | "\(.name)\t\(.conclusion)"'
Governance gates	success
dependency-review	success
lint	success
package	success
security	failure
spelling	success
markdownlint	success
actionlint	success
shellcheck	success
types	success
tests (ubuntu-latest)	success
tests (windows-latest)	success
Org repo hygiene / repo-hygiene / verify	success
Org CodeQL / CodeQL (actions)	success
Org OpenSSF Scorecard	skipped
ci-passed	failure
[exit 0]

Every job conclusion is shown above. The Python 3.11 security job and therefore ci-passed are red as expected: the released .github/scripts/setup.sh still installs the vulnerable setuptools version until the v1.0.7 fix is released and self-updated. Security audit lines:

2026-10-09T20:06:00.0467952Z Found 2 known vulnerabilities in 1 package
2026-10-09T20:06:00.0468929Z Name       Version ID              Fix Versions
2026-10-09T20:06:00.0469575Z ---------- ------- --------------- ------------
2026-10-09T20:06:00.0470143Z setuptools 79.0.1  PYSEC-2026-3447 83.0.0
2026-10-09T20:06:00.0470693Z setuptools 79.0.1  PYSEC-2026-3447 83.0.0
2026-10-09T20:06:00.0471025Z 
2026-10-09T20:06:00.0471184Z Name            Skip Reason
2026-10-09T20:06:00.0471621Z --------------- -------------------------------
2026-10-09T20:06:00.0472333Z python-template distribution marked as editable
2026-10-09T20:06:00.0914681Z 
2026-10-09T20:06:00.0915191Z --- Pip-Audit ---
2026-10-09T20:06:00.0933744Z ##[error]Pip-Audit failed with exit code 1
2026-10-09T20:06:00.0975512Z ##[error]Process completed with exit code 1.

Sequencing and bypass

This repair must merge first so later pull requests regain job-level evidence. Its required ci-passed check is expected to be red because the released copy of .github/scripts/setup.sh lacks the setuptools fix until v1.0.7 is released and self-updated. Merge therefore requires the repository-role bypass (gh pr merge --squash --admin) only after P4 PASS and a separate green-confirm entry, with the owner's standing authorization recorded. The same controlled bypass applies to PR #42 after it is updated from main; later self-update and template-sync pull requests are expected to merge normally after v1.0.7 and the floating tags are advanced.

Do not merge: P4 clean-room review pending